How to check the Enterprise App expiration date

As a service, LiveTiles can help you keep track on your App expiration date. By letting us know, we will store the date in our system and notify you 30 days before that date so you have time to have it renewed.

Before you start, you’ll need the following:

1) Install Microsoft Graph Powershell SDK: Install the Microsoft Graph PowerShell SDK

2) A tenant administrator user for the Office 365 tenant where the App was registered.

3) Create a 'Temp' folder on the C: drive - C:\Temp

Save and executing the script

1) Save below script as 'CheckApplicationsExpiry.ps1'

# =========================================================
# Enterprise App Credential Expiry Audit (Graph PowerShell)
# LiveTiles | Omnia 
# =========================================================

if (-not (Get-Module -ListAvailable -Name Microsoft.Graph)) {
    Install-Module Microsoft.Graph -Scope CurrentUser -Force
}

Connect-MgGraph -Scopes "Application.Read.All", "Directory.Read.All"
Write-Host "Connected ..."

Write-Host "Fetching all Service Principals (this may take a while) ..."
$servicePrincipals = Get-MgServicePrincipal -All
Write-Host "Fetched $($servicePrincipals.Count) applications ..."

# Filter out Microsoft/internal apps
$filteredApps = $servicePrincipals | Where-Object {
    ($_.DisplayName -notlike "*Microsoft*") -and
    ($_.DisplayName -notlike "autohost*") -and
    ($_.ServicePrincipalNames -notlike "*localhost*")
}

Write-Host "Filtered to $($filteredApps.Count) custom applications ..."

$appDetails = @()
$total = $filteredApps.Count
$index = 0

foreach ($app in $filteredApps) {
    $index++
    $percent = [math]::Round(($index / $total) * 100, 2)
    Write-Progress -Activity "Processing Apps" -Status "$index of $total ($percent%)" -PercentComplete $percent

    try {
        $sp = Get-MgServicePrincipal -ServicePrincipalId $app.Id -Property "displayName,appId,passwordCredentials,keyCredentials"
        $credentials = @()
        if ($sp.PasswordCredentials) { $credentials += $sp.PasswordCredentials }
        if ($sp.KeyCredentials) { $credentials += $sp.KeyCredentials }

        foreach ($cred in $credentials) {
            $type = if ($cred.PSObject.TypeNames -contains "Microsoft.Graph.PowerShell.Models.MicrosoftGraphKeyCredential") {
                "Certificate"
            } else {
                "ClientSecret"
            }

            $appDetails += [PSCustomObject]@{
                EnterpriseAppName = $sp.DisplayName
                ClientID          = $sp.AppId
                KeyId             = $cred.KeyId
                Type              = $type
                StartDate         = $cred.StartDateTime
                ExpiryDate        = $cred.EndDateTime
                DisplayName       = $cred.DisplayName
                Hint              = $cred.Hint
            }
        }
    }
    catch {
        $errorMessage = "[$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')] Failed for $($app.DisplayName): $($_.Exception.Message)"
        Write-Warning $errorMessage
        $errorMessage | Out-File "C:\Temp\GraphAppErrors.log" -Append
    }
}

$outputFile = "C:\Temp\ListOfEnterpriseApps.csv"
$appDetails | Export-Csv -Path $outputFile -NoTypeInformation
Write-Host "File created: $outputFile ..."
Write-Host "Press any key to exit ..."
$null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")

2) To execute the script in the file, open the PowerShell 7 program and navigate to the folder where the 'CheckApplicationsExpiry.ps1' script is - 'cd 'path'.
Example: C:\Users\Admin

3) Run the script and you will be prompted to login with your tenant administrator account.

Result

When the script has finished, you are now able to see the full output directly in the file that was generated in the 'Temp' folder.

The output is saved as a CSV file. The output will be written as follows:

NOTE: Date format is written as MM/DD/YYYY.

Looking at this output, you can see that this App is set to expire on January 16th, 2022.

Microsoft Excel tips and tricks

For better overview of the CSV output, we now give you some tips and tricks to see the data.

1) Mark the A column

2) In the ribbon, select the 'Data' section and click the 'Text to Columns'.

3) In Step 1 of 3, make sure that the Delimited type is selected and click 'Next'.

4) In Step 2 of 3, select the Comma delimiter and click 'Finish'

The data now shows correctly in columns (A-F)

5) Mark the columns that contains data and double-click on the vertical column separator line. The data now shows aligned.

6) Click on the A1 cell, go to the 'Data' section in the ribbon and click the 'Filter'.

7) In the B column (ClientID), you can filter on the current ClientID of the App you are searching for. Similar for the D column (Type), you only have to display the Password type.

8) For this App, we can see 3 registrations. The initial one that expired in 2016, the first extended one that expired in 2019 and now the current one that will expire in 2022.